Bug 803776 - Disable exposure of jmx stats for anonymous caches
Disable exposure of jmx stats for anonymous caches
Status: VERIFIED
Product: JBoss Enterprise Portal Platform 5
Classification: JBoss
Component: Portal (Show other bugs)
5.2.0.GA
All All
urgent Severity urgent
: ---
: 5.2.2.CR01
Assigned To: Honza Fnukal
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-03-15 11:53 EDT by Shaun Appleton
Modified: 2013-06-26 21:10 EDT (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
It was discovered that exposing information for anonymous caches using JMX resulted in too much information being exposed. The configuration has been changed to ensure JMX stats for anonymous caches display the correct information.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Commits:
8750 by hfnukal at 2012-06-27 03:11:15 EDT (show)
8750 by hfnukal at 2012-06-27 03:11:15 EDT

Checked in to /mnt/n4aphx2-3.storage.phx2.redhat.com/svn/repos/gatein

Bug 803776 - Disable exposure of jmx stats for anonymous caches

5 files changed:

  • epp/portal/branches/EPP_5_2_Branch/web/portal/src/main/webapp/WEB-INF/classes/picketlink-idm/idm-local-cache-config.xml (+4 / -0)
  • epp/portal/branches/EPP_5_2_Branch/web/portal/src/main/webapp/WEB-INF/conf/jbosscache/local/config.xml (+2 / -1)
  • epp/portal/branches/EPP_5_2_Branch/web/portal/src/main/webapp/WEB-INF/conf/jcr/jbosscache/local/config.xml (+3 / -0)
  • epp/portal/branches/EPP_5_2_Branch/web/portal/src/main/webapp/WEB-INF/conf/jcr/jbosscache/local/lock-config.xml (+2 / -0)
  • epp/portal/branches/EPP_5_2_Branch/web/portal/src/main/webapp/WEB-INF/conf/organization/picketlink-idm/jboss-cache.xml (+2 / -0)
8814 by hfnukal at 2012-08-09 12:21:53 EDT (show)
8814 by hfnukal at 2012-08-09 12:21:53 EDT

Checked in to /mnt/n4aphx2-3.storage.phx2.redhat.com/svn/repos/gatein

Bug 803776 - Disable exposure of jmx stats for anonymous caches

1 file changed:

  • epp/portal/branches/EPP_5_2_Branch/web/portal/src/main/webapp/WEB-INF/conf/jcr/jbosscache/local/config_portal-system.xml (+3 / -0)
mvanco: needinfo-


Attachments (Terms of Use)

  None (edit)
Description Shaun Appleton 2012-03-15 11:53:29 EDT
Description of problem:
The shindig.properties file is in shindig-common-2.0.2-CP01.jar  
It needs to be outside of a jar so the properties can be easily changed.

For example if I want to set shindig.cache.ehcache.jmx.enabled=false
it is in the shindig.properties file within deploy/gatein.ear/lib/shindig-common-2.0.2-CP01.jar 


Workaround:
Not known - I tried exploding the jar file but deployment failed.

How reproducible:
very

Steps to Reproduce:
1. File inspection
  
Actual results:
Can't alter the shindig.properties file

Expected results:
Being able to alter the shindig.properties file

Additional info:
As this is on by default in large installations (when JON is used) this causes great problems as JON will monitor these transient caches.
Comment 1 Larry O'Leary 2012-03-15 13:02:37 EDT
Adding Bug 802902 to See Also list as it identifies the transient and on demand cache scenario as a problem in the upstream JBoss Cache plug-in from the RHQ Project.
Comment 4 Charles Crouch 2012-03-27 12:42:57 EDT
Increasing Severity to understand when this could be investigated
Comment 5 Thomas Heute 2012-03-28 10:41:20 EDT
I still can't reproduce. I don't see any of those JBoss Cache MBeans in the JMX console, whatever I try in the portal.

Portal is started with "-c all"
Comment 6 Larry O'Leary 2012-04-20 11:03:59 EDT
Just realized that this hasn't been updated with the new information...

To reproduce, enable the JBoss platform MBean server (system property jboss.platform.mbeanserver). The reason we do not see it without this is because the MBeans are being installed into the JVM's MBean server and can only be seen with JConsole unless the JBoss and JVM MBean servers are merged using said property.
Comment 7 Larry O'Leary 2012-04-23 18:46:03 EDT
Based on a response received from Martin on a possible way to alleviate the stats being exposed for these MBeans:

...
I don't know if 'transient' is the proper attribute for these JBoss Cache MBeans. To me it looks like they just don't have a defined name. Anyway, with a bit of trying, I found that these could be disabled by adding <jmxStatistics enabled="false"/> and <attribute name="exposeManagementStatistics">false</attribute> to the JBC config files in EPP 5.2. 

File: deploy/gatein.ear/02portal.war/WEB-INF/classes/picketlink-idm/idm-local-cache-config.xml
File: deploy/gatein.ear/02portal.war/WEB-INF/conf/jbosscache/local/config.xml
File: deploy/gatein.ear/02portal.war/WEB-INF/conf/jcr/jbosscache/local/config.xml
File: deploy/gatein.ear/02portal.war/WEB-INF/conf/jcr/jbosscache/local/lock-config.xml
File: deploy/gatein.ear/02portal.war/WEB-INF/conf/organization/picketlink-idm/jboss-cache.xml
Comment 10 Michal Vanco 2012-07-27 09:31:41 EDT
Shaun, Larry: patch from comment 7 was applied in EPP 5.2.2 ER01 release. Is there something else what can be verified?
I have two questions, why is it applied only at local configuration and not in cluster? Previous issue with shindig.properties configuration isn't solved by this issue, is it expected by above comments? or it still needs to be fixed?
Thanks
Comment 11 Larry O'Leary 2012-07-30 11:30:32 EDT
(In reply to comment #10)
> Shaun, Larry: patch from comment 7 was applied in EPP 5.2.2 ER01 release. Is
> there something else what can be verified?

For verification we just need to make certain these caches are not exposed when the system property jboss.platform.mbeanserver is used (as per comment 6).

Before the fix, MBeans similar to the following would appear:

jboss.cache:service=JBossCache,uniqueId=67afe177 and jboss.cache:service=JBossCache,uniqueId=67afe177,jmx-resource=TxInterceptor
jboss.cache:service=JBossCache,uniqueId=67afe177,jmx-resource=RegionManager

The key thing being the `uniqueId=67afe177` where the hash would change every time EPP was started. The fix should prevent these MBeans from appearing.


> why is it applied only at local configuration and not in cluster? 

In cluster, the cache names are static. In non-cluster, the cache names are undefined resulting in a random ID being used for their name. Perhaps this change should apply to both clustered and non-clustered but it only caused issues in non-clustered.

> Previous issue with shindig.properties configuration isn't solved by this issue, is it expected by above comments? or it still needs to be fixed?

Correct, this bug and its resolution has no impact on shindig.properties. The original thought was that it was a configuration option in shindig.properties that was causing this bug but after further analysis, it was determined that this issue had nothing to do with property values in shindig.properties.
Comment 12 Michal Vanco 2012-08-01 05:30:39 EDT
Thanks Larry for more details.

I have just tried EPP 5.2.2 ER03 with -Djboss.platform.mbeanserver parameter and I can still see these caches at jboss.cache category:
jmx-resource=CacheMgmtInterceptor,service=JBossCache,uniqueId=22d0280b
jmx-resource=CacheMgmtInterceptor,service=JBossCache,uniqueId=26b9569e
jmx-resource=CacheMgmtInterceptor,service=JBossCache,uniqueId=5c9a0ba2
jmx-resource=DataContainer,service=JBossCache,uniqueId=22d0280b
jmx-resource=DataContainer,service=JBossCache,uniqueId=26b9569e
jmx-resource=DataContainer,service=JBossCache,uniqueId=5c9a0ba2
jmx-resource=InterceptorChain,service=JBossCache,uniqueId=22d0280b
jmx-resource=InterceptorChain,service=JBossCache,uniqueId=26b9569e
jmx-resource=InterceptorChain,service=JBossCache,uniqueId=5c9a0ba2
jmx-resource=MVCCLockManager,service=JBossCache,uniqueId=5c9a0ba2
jmx-resource=OptimisticTxInterceptor,service=JBossCache,uniqueId=22d0280b
jmx-resource=RPCManager,service=JBossCache,uniqueId=22d0280b
jmx-resource=RPCManager,service=JBossCache,uniqueId=26b9569e
jmx-resource=RPCManager,service=JBossCache,uniqueId=5c9a0ba2
jmx-resource=RegionManager,service=JBossCache,uniqueId=22d0280b
jmx-resource=RegionManager,service=JBossCache,uniqueId=26b9569e
jmx-resource=RegionManager,service=JBossCache,uniqueId=5c9a0ba2
jmx-resource=TransactionTable,service=JBossCache,uniqueId=22d0280b
jmx-resource=TransactionTable,service=JBossCache,uniqueId=26b9569e
jmx-resource=TransactionTable,service=JBossCache,uniqueId=5c9a0ba2
jmx-resource=TxInterceptor,service=JBossCache,uniqueId=26b9569e
jmx-resource=TxInterceptor,service=JBossCache,uniqueId=5c9a0ba2
service=InvalidationManager

As far as I understood Lary's comment, above MBeans shouldn't be present after fix, but they are.

Above list is present when running "default" configuration, when I run "all" configuration, there are much more caches with static names but above are present as well.
Assigning back...
Comment 13 Honza Fnukal 2012-08-03 10:53:34 EDT
Basicly I run EPP: run.sh -c all -Djboss.platform.mbeanserver and open http://localhost:8080/jmx-console/, set filter to jboss.cache:service=JBossCache*,*
 
 This is what I have now:
cluster=DefaultPartition-HAPartitionCache,jmx-resource=CacheMgmtInterceptor,service=JBossCache
cluster=DefaultPartition-HAPartitionCache,jmx-resource=DataContainer,service=JBossCache
cluster=DefaultPartition-HAPartitionCache,jmx-resource=InterceptorChain,service=JBossCache
cluster=DefaultPartition-HAPartitionCache,jmx-resource=RPCManager,service=JBossCache
cluster=DefaultPartition-HAPartitionCache,jmx-resource=RegionManager,service=JBossCache
cluster=DefaultPartition-HAPartitionCache,jmx-resource=TransactionTable,service=JBossCache
cluster=DefaultPartition-HAPartitionCache,jmx-resource=TxInterceptor,service=JBossCache
cluster=DefaultPartition-SessionCache,jmx-resource=CacheMgmtInterceptor,service=JBossCache
cluster=DefaultPartition-SessionCache,jmx-resource=DataContainer,service=JBossCache
cluster=DefaultPartition-SessionCache,jmx-resource=InterceptorChain,service=JBossCache
cluster=DefaultPartition-SessionCache,jmx-resource=LegacyActivationInterceptor,service=JBossCache
cluster=DefaultPartition-SessionCache,jmx-resource=LegacyPassivationInterceptor,service=JBossCache
cluster=DefaultPartition-SessionCache,jmx-resource=RPCManager,service=JBossCache
cluster=DefaultPartition-SessionCache,jmx-resource=RegionManager,service=JBossCache
cluster=DefaultPartition-SessionCache,jmx-resource=TransactionTable,service=JBossCache
cluster=DefaultPartition-SessionCache,jmx-resource=TxInterceptor,service=JBossCache
jmx-resource=CacheMgmtInterceptor,service=JBossCache,uniqueId=66ca0069
jmx-resource=DataContainer,service=JBossCache,uniqueId=66ca0069
jmx-resource=InterceptorChain,service=JBossCache,uniqueId=66ca0069
jmx-resource=MVCCLockManager,service=JBossCache,uniqueId=66ca0069
jmx-resource=RPCManager,service=JBossCache,uniqueId=66ca0069
jmx-resource=RegionManager,service=JBossCache,uniqueId=66ca0069
jmx-resource=TransactionTable,service=JBossCache,uniqueId=66ca0069
jmx-resource=TxInterceptor,service=JBossCache,uniqueId=66ca0069

Patch is identical as in custommer case https://na7.salesforce.com/500A0000009eyqd
Comment 14 Michal Vanco 2012-08-07 06:16:16 EDT
Based on my previous comment, I can still see same caches with uniqueId (same list as mentioned by Honza).
I think the goal of is issue was to remove (do not expose) these caches in jmx.
It seems like provided customer patch didn't fully cover the issue.

@Larry, can you confirm?
Comment 15 Larry O'Leary 2012-08-07 12:00:44 EDT
Martin, can you comment here. Are the results Michal and Honza seeing the expected ones with this change? I was under the impression that the JBossCache MBeans would not be exposed. Perhaps I am mistaken and the MBeans still are exposed but have no stats methods? What are we missing for our test-case?
Comment 16 Martin Weiler 2012-08-07 17:58:18 EDT
I just tested with ER04 and got the same results (one cache MBean with a randomly generated name showing up in jmx-console) as in comment #13. Apparently a new file has been added to EPP 5.2, which also needs the jmxStatistics element to be set to false explicitly:
gatein.ear/02portal.war/WEB-INF/conf/jcr/jbosscache/local/config_portal-system.xml

In addition (although it does not do any harm), the same element can be removed (twice) from idm-local-cache-config.xml (cache exposure is disabled there with the exposeManagementStatistics attribute already).
Comment 17 Michal Vanco 2012-08-08 03:04:07 EDT
Martin, thanks for this update!
I have tried with <jmxStatistics enabled="false"/> at local/config_portal-system.xml and now I get expected results - no caches with uniqueId present at jmx.
Honza, can you please update this file and include in CR01? Thanks
Comment 18 Honza Fnukal 2012-08-24 09:44:41 EDT
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause: Exposing info by JMX is set in config.
Consequence: Too many info exposet by JMX
Fix: Configuration changed
Result: Correct info shown by JMX
Comment 19 Jared MORGAN 2012-08-27 19:24:48 EDT
    Technical note updated. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    Diffed Contents:
@@ -1,4 +1 @@
-Cause: Exposing info by JMX is set in config.
+It was discovered that exposing information for anonymous caches  using JMX resulted in too much information being exposed. The configuration has been changed to ensure JMX stats for anonymous caches display the correct information.-Consequence: Too many info exposet by JMX
-Fix: Configuration changed
-Result: Correct info shown by JMX

Note You need to log in before you can comment on or make changes to this bug.